CotalDispatch a native manager authority request
Fresh JSON idpToken derives the owner; request.actor is checked against its current interactive ledger grant. Native request kinds and phase-specific results are not a stable cloud API. Manager lifecycle prepare/activate/renew/retire, enrollment, retirement preparation, retained validation, goal-index scan, admin authorization and run operations dispatch to their native contracts. Stock runtime-create/runtime-status and delegated intent kinds require host interception; the HTTP wrapper currently reports those refusals as 403 (not 501). Missing IdP proof is 400; a native conflict, such as a name another lifecycle holds or a stale serve epoch, is 409; failed proof, native parser/authority/unsupported failures are 403. A 403 or 409 refusal is 429 instead when the peer is throttled. Origin is refused. Credential verification and native dispatch failures share the public peer refusal budget.
UTF-8 JSON; maximum 65536 bytes. An Authorization header does not replace the JSON proof.
application/json- body
idpToken*string1 <= lengthrequest*Transport envelope only. Nested native fields and operation-specific constraints are defined by RemoteManagerAuthorityRequest and dispatchManagerAuthorityRequest request union in the linked source; this schema is not a complete native command contract.
Successful response.
application/json- response
Native dispatch result union. The optional documented fields describe RemoteManagerAuthorityMaterial, including prepare credentials; other dispatched result arms use their own native contracts. This schema validates the object transport envelope, not every phase-specific result.
v*unknownkind*stringoperation?stringspace?string1 <= lengthowner?string1 <= lengthactor?string1 <= lengthinstanceId?string1 <= lengthlifecycleUid?string1 <= lengthrequestId*string1 <= lengthissuedAt?integer0 <= valueexpiresAt?integer0 <= valuecredentials?curl -X POST 'https://auth.example.invalid/manager-service-authority' \ -H 'Content-Type: application/json' \ -d '{ "idpToken": "string", "request": { "actor": "string" }}'{ "v": 1, "kind": "string", "operation": "string", "space": "string", "owner": "string", "actor": "string", "instanceId": "string", "lifecycleUid": "string", "requestId": "string", "issuedAt": 0, "expiresAt": 0, "credentials": { "supervisor": { "jwt": "string", "exp": 0 }, "executor": { "jwt": "string", "exp": 0 }, "serve": { "jwt": "string", "exp": 0 }, "goalWriter": { "jwt": "string", "exp": 0 }, "sessionLedger": { "jwt": "string", "exp": 0 }, "runDriver": { "jwt": "string", "exp": 0 }, "runMediator": { "jwt": "string", "exp": 0 }, "sessionServing": { "jwt": "string", "exp": 0 }, "retirementRequester": { "jwt": "string", "exp": 0 }, "transferReader": { "jwt": "string", "exp": 0 } }}See the HTTP interface overview for authentication and access requirements.
Complete HTTP contract
Endpoint
POST /manager-service-authorityFresh JSON idpToken derives the owner; request.actor is checked against its current interactive ledger grant. Native request kinds and phase-specific results are not a stable cloud API. Manager lifecycle prepare/activate/renew/retire, enrollment, retirement preparation, retained validation, goal-index scan, admin authorization and run operations dispatch to their native contracts. Stock runtime-create/runtime-status and delegated intent kinds require host interception; the HTTP wrapper currently reports those refusals as 403 (not 501). Missing IdP proof is 400; a native conflict, such as a name another lifecycle holds or a stale serve epoch, is 409; failed proof, native parser/authority/unsupported failures are 403. A 403 or 409 refusal is 429 instead when the peer is throttled. Origin is refused. Credential verification and native dispatch failures share the public peer refusal budget.
Parameters
No operation parameters.
Request body
UTF-8 JSON; maximum 65536 bytes. An Authorization header does not replace the JSON proof.
Required: yes.
Content type: application/json.
{
"$ref": "#/components/schemas/ManagerRequest"
}Responses
HTTP 200
Successful response.
Content type: application/json.
{
"$ref": "#/components/schemas/ManagerResult"
}HTTP 400
JSON error from a named request refusal. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413.
Content type: application/json.
{
"$ref": "#/components/schemas/Error"
}HTTP 403
JSON error from a named request refusal. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413.
Content type: application/json.
{
"$ref": "#/components/schemas/Error"
}HTTP 405
JSON error from a named request refusal. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413.
Content type: application/json.
{
"$ref": "#/components/schemas/Error"
}HTTP 409
JSON error from a named request refusal. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413.
Content type: application/json.
{
"$ref": "#/components/schemas/Error"
}HTTP 413
JSON error from a named request refusal. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413.
Content type: application/json.
{
"$ref": "#/components/schemas/Error"
}HTTP 415
JSON error from a named request refusal. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413.
Content type: application/json.
{
"$ref": "#/components/schemas/Error"
}HTTP 429
JSON error from a named request refusal. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413.
Content type: application/json.
{
"$ref": "#/components/schemas/Error"
}HTTP 500
Server failure. An unexpected failure reaching the listener boundary returns only {"error":"internal server error"}; details are logged server-side. A route's named server failure may include its error code and outcome.
Content type: application/json.
{
"$ref": "#/components/schemas/Error"
}Example:
{
"error": "internal server error"
}HTTP 503
Public admission cap (64 in flight), 10 second request deadline, or a route-specific unavailable read/effect. A service authority 503 may follow a binding; retain the request identity.
Content type: application/json.
{
"$ref": "#/components/schemas/Error"
}Authentication and access: HTTP interface of the stock auth public listener: 11 paths and 12 operations. Public means reachable through the configured listener, not unauthenticated. This implementation surface uses Cotal native contracts and does not establish a stable cloud API. Description version 1.0.0 identifies this document, not the wire or npm package version.
Credentials are JSON body proofs, with no loopback capability required. No CORS headers are sent. All POST routes and service authority GET reject any Origin header. Health, JWKS and mesh discovery GET permit Origin headers.
The listener binds 127.0.0.1; an operator HTTPS proxy supplies the external origin. Service endpoint routes require service endpoints enabled. Route lookup uses the exact request target: query strings and trailing slashes do not match and return JSON 404. Unknown paths and loopback-only lifecycle, enrollment verification, human-proof and consent routes return JSON 404. Configuration and route-specific native parser checks remain authoritative.
POST JSON bodies default to 65536 bytes; service authority accepts 2097152 bytes. Public work has 64 concurrent admissions and a 10000 ms deadline. Its separate rolling 30-refusal/minute peer budget is bounded to 1024 peer entries. Failure accounting is route-specific. Manager dispatch failures and chat native or store failures can consume the budget after valid proof verification. Otherwise successful requests are still evaluated when the refusal budget is full. Peer is socket address unless trusted proxy mode selects the last X-Forwarded-For hop.
OpenAPI specification contains the referenced response schemas. Complete Markdown reference.